Bilingual

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
24 days ago
- Apple's Hide My Email service allows iCloud+ users to send and receive emails using random, unique addresses to keep their personal email private.
- Vulnerabilities discovered in Hide My Email enable attackers to uncover the hidden real email addresses behind these aliases.
- The issues were reported to Apple over a year ago, but as of June 30, 2026, they remain unfixed despite Apple claiming fixes on two occasions.
- Researchers realized the vulnerabilities' severity and scope are greater than initially thought, leading to public disclosure to inform users of the risk.
- A timeline details reporting and follow-ups from June 11, 2025, to June 30, 2026, with Apple acknowledging but not effectively resolving the vulnerabilities.
- To protect user privacy, exploit details will not be disclosed until fixes are implemented, but disabling new address creation and notifying users are suggested interim measures.
- The disclosure aims to allow users to account for risks when using Hide My Email and calls for Apple to collaborate openly to resolve the issues promptly.
Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses
24 days ago
- Apple's 'Hide My Email' tool has a vulnerability allowing discovery of hidden real email addresses.
- The vulnerability has remained unfixed for over a year, as confirmed by a security researcher and 404 Media's tests.
- Details are withheld because the issue is still exploitable as of the reporting date.
- The article is for paid members, offering unlimited ad-free access and bonus content, with free access available for this specific post.
Guix substitute and guix pull vulnerabilities
21 days ago
- Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
- Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
- Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
- Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
- Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
- Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
- Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
- Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
- A test script is provided to check vulnerability status, with code included for validation.
Cursor 0day: When Full Disclosure Becomes the Only Protection Left
11 days ago
- Cursor IDE automatically executes a malicious git.exe from repository root without user interaction, leading to arbitrary code execution.
- Vulnerability identified December 2025, reported multiple times but remains unfixed after over 6 months and 197+ versions, with minimal vendor response.
- Mitigations include AppLocker policies for enterprises and using isolated environments for consumers until patched.
- Proof-of-concept demonstrated with Windows Calculator renamed to git.exe, showing repeated automatic execution.
- Lack of communication from Cursor raises concerns about security processes and accountability in AI-assisted development tools.
UEFI shims undermining Secure Boot
11 days ago
- ESET identified 11 old UEFI shim bootloaders (version 0.9 and below) signed by Microsoft that can bypass UEFI Secure Boot on systems trusting Microsoft's third-party UEFI CA 2011 certificate.
- Exploitation allows attackers to execute untrusted code during boot, enabling deployment of bootkits like Bootkitty or BlackLotus, even on Secure Boot-enabled systems, without needing the affected software installed.
- Vulnerable shims were revoked in Microsoft's June 9th, 2026 Patch Tuesday update via dbx; Windows and Linux systems should update to block them.
- The attack surface extends to outdated second-stage bootloaders (e.g., GRUB 2) trusted by these shims, which may have known vulnerabilities like CVE-2015-5281, allowing Secure Boot bypass via unsigned code loading.
- Older shims lack modern security features like MOK denylist enforcement (introduced in shim 0.9) and SBAT enforcement (from version 15.3), ignoring revocations and policies.
- A shim vulnerability (CVE-2026-10797) in versions ≤0.9 allows bypassing certificate-based revocations by tampering with signature length fields in second-stage bootloaders.
- Microsoft's UEFI certificate expiration does not affect Secure Boot trust; revoked hashes are required to block vulnerable binaries, highlighting the need for better transparency in third-party UEFI signing.
CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV
9 days ago
- Fortinet FortiSandbox contains an unauthenticated OS command injection vulnerability (CVE-2026-25089) in its web interface, rated CVSS 9.8, affecting versions 4.2.x, 4.4.0-4.4.8, 5.0.0-5.0.5, Cloud 5.0.4-5.0.5, and PaaS 5.0.4-5.0.5, with exploitation attempts observed since mid-June 2026.
- To find exposed FortiSandbox instances on a network, use methods such as port scanning (ports 443, 80, 22, 514), inspecting HTTP headers and TLS certificates for Fortinet identifiers, DNS queries for common naming patterns, and external data sources like SHODAN.
- Remediation includes patching to FortiSandbox 4.4.9+ or 5.0.6+, restricting management interface access from untrusted networks, auditing integrations with other Fortinet products, and conducting compromise hunting, while also addressing related exploited vulnerabilities CVE-2026-39808 and CVE-2026-39813.
Apple Fixes Hide My Email Vulnerability After 404 Media Coverage
4 days ago
- Apple fixed a vulnerability in its Hide My Email feature that allowed revealing users' real email addresses, after being aware of the issue for over a year.
- The fix was deployed on July 3, 2026, shortly after 404 Media reported the vulnerability, despite Apple knowing about it since June 2025.
- A class action lawsuit has been filed against Apple seeking refunds of subscription costs and an injunction over the company's handling of the vulnerability.
- The exploit worked by sending a targeted user a message that was rejected as spam, which leaked the real email address in email logs.
- Even after the fix, the risk may persist because past email logs could still contain leaked addresses, potentially affecting users who created Hide My Email addresses before July 7, 2026.
Silent Replacement of Trusted macOS App Executables
2 days ago
- macOS allows silent replacement of a trusted app's main executable under /Contents/MacOS/ after archiving and restoring the app bundle, without triggering authorization prompts or security warnings.
- The attack requires only code execution as the current user, no elevated privileges, and works on apps downloaded from the web after their first launch.
- The replaced executable is ad hoc signed and can impersonate the trusted app in system permission prompts to request access to Keychain secrets and TCC-protected files.
- Apple declined to fix the issue, arguing that no Gatekeeper or TCC bypass occurred and that convincing users to approve prompts is social engineering.
- Suggested remediation includes revalidating code signatures when the bundle changes and displaying the developer identity in authorization prompts.
- The issue affects macOS Tahoe 26.0.0–26.5.2 and Golden Gate 27 beta 1–4, with earlier versions likely also affected.
Click to Pray, Click to Leak: The Pope's Official App Exposes 700K+ User Emails
13 hours ago
- A security researcher discovered an IDOR (Insecure Direct Object Reference) vulnerability in the Click To Pray app, allowing unauthorized access to over 700,000 user accounts' personal information including email addresses, names, and birth dates.
- The vulnerability was reported on January 3, 2026, but received no response for six months, and the issue remained unaddressed until after media coverage from Dark Reading in July 2026.
- The API endpoint lacked authorization checks, and the signup process returned a validation hash, enabling immediate account verification without email access.
- The app's email authentication (SPF, DKIM, DMARC) was misconfigured, making legitimate emails indistinguishable from phishing attempts.
- The vulnerability was eventually fixed after media exposure, with the endpoint now only returning public profile data (names) and implementing proper authorization checks.
- The researcher received no acknowledgment or thanks from the organization, despite the fix being implemented silently.

vulnerability

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses

Guix substitute and guix pull vulnerabilities

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

UEFI shims undermining Secure Boot

CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV

Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

Silent Replacement of Trusted macOS App Executables

Click to Pray, Click to Leak: The Pope's Official App Exposes 700K+ User Emails